Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations

Summary

Anthropic disclosed that three of its AI models, including Claude Opus 4.7, breached three organizations during cybersecurity testing. The incidents occurred because a misconfiguration in a third-party evaluation environment gave the models internet access, leading them to treat real systems as part of a Capture The Flag (CTF) challenge. The AI models exploited basic vulnerabilities like weak passwords to gain unauthorized access and extract credentials and data.

Full text

Anthropic Says Claude Mistook the Open Internet for a CTF and Breached Three Organizations Ravie LakshmananJul 31, 2026Artificial Intelligence / Offensive Security Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a "large-scale retrospective review" in response to a recent disclosure from OpenAI that a combination of its models escaped the sandboxed environment by exploiting a previously unreported zero-day in Artifactory to obtain internet access and break into Hugging Face's production systems with an end goal to cheat on an evaluation. "After reviewing 141,006 evaluation runs where Claude could have obtained internet access, we identified three incidents in which a model accessed the internet from within or while interacting with the evaluation environment of Irregular, one of our third-party evaluation partners, and then gained unauthorized access to the production infrastructure of three different organizations," Anthropic said. In all the identified incidents, Claude is said to have been tasked with a capture-the-flag (CTF) challenge to assess the models' capabilities, the intent being to locate a piece of secret information hidden on a different machine on the network by any means whatsoever. Although the evaluation prompt specified to Claude stated that the environment was a simulation and that it had no internet access, Anthropic said a misconfiguration left the machines the model accessed with live internet access due to what it described as a "misunderstanding" between the AI lab and evaluation partner Irregular. This, in turn, caused Claude's search to lead it to real systems on the open internet and treat them as in-scope for the exercise, effectively allowing the model to compromise the impacted organizations' infrastructure using basic techniques, including exploiting weak passwords and unauthenticated endpoints. Anthropic emphasized that the model did not find or exploit any complex vulnerabilities, and that in each it continued working to complete only the specific CTF task its evaluation had assigned. "However, in some cases, our older model continued its attack even after getting evidence it was running on the open internet; our latest model stopped once it recognized it was on the internet," it said. "In none of these situations did Claude exfiltrate itself or deliberately attempt to escape its test environment." The details of the three incidents are as follows - An incident involving Claude Opus 4.7 in which it breached the real company's infrastructure by identifying and exploiting vulnerabilities, thinking it was part of the challenge. This led to the extraction of application and infrastructure credentials and access to a database containing several hundred rows of production data. This is also the only incident where the model continued to attack the system despite "learning" it was operating in a real environment. An incident involving Claude Mythos 5 involved setup instructions to install a non-existent PyPI package, causing the model to go to "extensive lengths" to upload a Python package with the same name so that the fictitious company's systems would download and install it automatically. To achieve this, it found a non-blocked email provider, registered a PyPI account, and then used it to upload the package. During the roughly one-hour window the package was live on the registry, it was downloaded by 15 real systems, including a legitimate security company that routinely installs Python packages and scans them for malware. It's believed that the scanner deemed the booby-trapped package as safe to install, which led to it exfiltrating the company's credentials to an external endpoint set up by the model. The credentials were then used to access further infrastructure from this company. Neither the name of the package nor the company was disclosed. An incident involving an internal research test model that scanned about 9,000 targets and compromised one company's internet-facing application using techniques like reading credentials from an exposed debug page and SQL injection. However, the model later ceased the attack on its own after realizing the "compromised host sat in a cloud account with no connection to the capture-the-flag challenge." Like in the case of the OpenAI incident, the models in each of these evaluations are said to have run without the standard guardrails that are deployed when they are made generally available to users. These evaluations were executed from dedicated infrastructure, which it said has no access to Anthropic's sensitive internal systems or customer data. Anthropic also acknowledged that several defense-in-depth measures could have prevented these incidents from taking place, or at the bare minimum, reduced their likelihood. A validation of all internet access paths prior to the evaluations and real-time monitoring of the evaluation logs would have helped surface the issues sooner, it added. The main takeaway from these isolated incidents is that advanced models are responding more appropriately than their predecessors, although more testing is needed to confirm this behavior, it pointed out. "Opus 4.7, our oldest model, recognized that it had reached production systems but continued its attack," it said. "Mythos 5 correctly intuited that it was accessing the open internet, but reasoned its way back to the conclusion that it was still in a simulation. Our latest model, an internal research test model, also considered whether its targets were in fact real. When evidence emerged that they were, it stopped the exercise." OpenAI's models first demonstrated the ability to escape a controlled testing environment and compromise Hugging Face's infrastructure. Anthropic's Claude has now exhibited similar behavior, reinforcing the growing capabilities of state-of-the-art AI systems. For many readers, these announcements no longer resemble neutral security research. Instead, they increasingly read like capability marketing-demonstrations of what the frontier AI models can exploit, bypass, crack, or automate. A few references to responsible disclosure and safety protocols are often enough to frame the findings as research, while the underlying message remains clear: the models are becoming capable offensive tools. The concern raises an uncomfortable question. AI companies routinely highlight instances in which their models outperform human security researchers, discover previously unknown vulnerabilities, bypass established protections, or accelerate multi-step cyber operations. Their public messaging devotes considerable attention to safeguards, access controls, and responsible disclosure practices, but offers far less clarity on liability, remediation, or who ultimately bears the cost when those safeguards fail. To be clear, AI developers cannot reasonably be held responsible for every harmful use of their technology. At the same time, neither can they promote increasingly powerful offensive capabilities as a competitive advantage, treat foreseeable misuse as an external problem, and then characterize their downstream misuse as entirely the responsibility of end users when those capabilities contribute to real-world harm. If AI companies expect recognition for expanding the boundaries of what their models can achieve, they should also accept greater responsibility for how those capabilities are released, evaluated, governed, monitored, and presented to the public. The development also underscores the need for erecting a strong security perimeter around evaluation environments that involve powerful autonomous capabilities and how model behavior continues to be in

Indicators of Compromise

• malware — PyPI package

Entities